- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Alerting
- :
- How to re-run a scheduled correlation search after...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Where there is a planned scheduled outage of a network device, which will effectively kill many of the feeds due to come into splunk, what would be the best approach to re-running correlation searches on the missing feeds once connection has been restored?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can use the curl command to trigger the searches from back-end without changing its properties.
eg. curl -k -u username:Password https://localhost:9086/services/saved/searches/testkamal2/reschedule -X POST
This will immediately trigger your search. You can write a script to trigger the queries one by one every few mins.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can use the curl command to trigger the searches from back-end without changing its properties.
eg. curl -k -u username:Password https://localhost:9086/services/saved/searches/testkamal2/reschedule -X POST
This will immediately trigger your search. You can write a script to trigger the queries one by one every few mins.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How would this work for effectively looking at the missed data from the restored feed? Surely that command would only run the search now, not step back through the data? Or am I missing something obvious (admittedly, highly likely)?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Aren't correlation searches real time searches that run based on index time, rather than event time?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Nope, they run at scheduled intervals, and if the event feed is delayed, things can be missed.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just did a little reading into this approach, and I think you are right, as shown in the example from the rest api page:
curl -k -u admin:pass https://localhost:8089/services/saved/searches/Purchased%20products%2C%20last%2024%20hours/reschedul... -d schedule_time=2012-08-15T14:11:01Z
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
